hxxp://br-rio-anx-r007[.]router[.]teamviewer[.]com

Analysis

max time kernel
899s
max time network
608s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://br-rio-anx-r007.router.teamviewer.com
Sample260809-dt9q2agq21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3868	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307191842317413"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{44A5C181-0A3D-4F34-92C3-53E95BBD1E20}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4532	1172	msedge.exe	84
PID 1172 wrote to memory of 3868	1172	msedge.exe	87
PID 1172 wrote to memory of 440	1172	msedge.exe	88
PID 1172 wrote to memory of 440	1172	msedge.exe	88
PID 1172 wrote to memory of 1300	1172	msedge.exe	89
PID 1172 wrote to memory of 440	1172	msedge.exe	88
PID 1172 wrote to memory of 1300	1172	msedge.exe	89
PID 1172 wrote to memory of 1296	1172	msedge.exe	90
PID 1172 wrote to memory of 3608	1172	msedge.exe	91
PID 1172 wrote to memory of 1296	1172	msedge.exe	90
PID 1172 wrote to memory of 1296	1172	msedge.exe	90
PID 1172 wrote to memory of 3608	1172	msedge.exe	91
PID 1172 wrote to memory of 3608	1172	msedge.exe	91
PID 1172 wrote to memory of 2372	1172	msedge.exe	92
PID 1172 wrote to memory of 5004	1172	msedge.exe	93
PID 1172 wrote to memory of 2372	1172	msedge.exe	92
PID 1172 wrote to memory of 2372	1172	msedge.exe	92
PID 1172 wrote to memory of 5004	1172	msedge.exe	93
PID 1172 wrote to memory of 5004	1172	msedge.exe	93
PID 1172 wrote to memory of 3764	1172	msedge.exe	94
PID 1172 wrote to memory of 3764	1172	msedge.exe	94
PID 1172 wrote to memory of 3764	1172	msedge.exe	94
PID 1172 wrote to memory of 1628	1172	msedge.exe	102
PID 1172 wrote to memory of 568	1172	msedge.exe	103
PID 1172 wrote to memory of 1628	1172	msedge.exe	102
PID 1172 wrote to memory of 568	1172	msedge.exe	103
PID 1172 wrote to memory of 3120	1172	msedge.exe	105
PID 1172 wrote to memory of 2228	1172	msedge.exe	109
PID 1172 wrote to memory of 3944	1172	msedge.exe	110
PID 1172 wrote to memory of 2448	1172	msedge.exe	111
PID 1172 wrote to memory of 3684	1172	msedge.exe	112
PID 1172 wrote to memory of 3684	1172	msedge.exe	112
PID 1172 wrote to memory of 4460	1172	msedge.exe	113
PID 1172 wrote to memory of 4460	1172	msedge.exe	113
PID 1172 wrote to memory of 4916	1172	msedge.exe	114
PID 1172 wrote to memory of 560	1172	msedge.exe	115
PID 1172 wrote to memory of 560	1172	msedge.exe	115
PID 1172 wrote to memory of 4796	1172	msedge.exe	116
PID 1172 wrote to memory of 4796	1172	msedge.exe	116
PID 1172 wrote to memory of 5068	1172	msedge.exe	117
PID 1172 wrote to memory of 5068	1172	msedge.exe	117
PID 1172 wrote to memory of 1812	1172	msedge.exe	118
PID 1172 wrote to memory of 1812	1172	msedge.exe	118
PID 1172 wrote to memory of 1352	1172	msedge.exe	119
PID 1172 wrote to memory of 1352	1172	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://br-rio-anx-r007.router.teamviewer.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffd3f86c188,0x7ffd3f86c194,0x7ffd3f86c1a0
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,4196006022068036657,18110135716845875357,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,10185455369509737195,16722244617873820525,262144 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,5113483374195295,15778413174701347250,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9310110144161339022,14734081627397582638,2097152 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,11782946529689504589,4337312677982962303,2097152 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,17205547007956805713,12051270554875794297,2097152 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,234103757319207800,980813520096662094,2097152 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4936,i,16197920265892137071,6047893725143972049,2097152 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,16426299343292148292,5655967892381246271,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,11292808322331008578,11632280289982683512,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,12560014364675421369,3405008177258966548,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,12560014364675421369,3405008177258966548,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,13236184976564272520,14171267166225780299,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,18380433009298909764,8859629780027200671,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,16755665017904834988,15943101349217493566,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,12168661290487945440,18147385559529286935,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,9727941631595960883,6798423929339867768,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3560,i,6815107132344421656,3436870535338164521,262144 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,15485287230610474525,4887255438444155892,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,6588970636534129784,9401385708595843116,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11647820879305112026,13713454318713337083,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,433501717135473787,947785722675641179,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,14293161793797877047,7688831995732787386,524288 --field-trial-handle=3036,i,760231829265064689,14957196029497466749,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7073226b4cd1cfc4cf618f45a53939bc635bacfa557eafd1683ee91614cda0d8
MD5 5ff1793d8c9849e8aa6f4b07eaa08bef
SHA1 f5fe82f06b14c36eb220d075b1991d8ce3ddd649
SHA512 12cef1a00cae76ef3fc336350f290b288914eff9dcc7d486d3ac1f47bd4fde52db613b450bb58f380ab912b64ce3ec0b76fcdbb59da73ad728aa42c2e562ab9f
TLSH
T177D012A27A0DB440F6055331E25383012666256028535702B261D41CD6644DC13D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a3d10b16d8afe0c105f8b187f8f3616b1a6a5acead1299db43d8132ffbdd701
MD5 b1909b2a7b7440e7b9a3adf7750f7e70
SHA1 b05948679b364b6e193b3dfce38acfcbbce327a5
SHA512 6e1a661cdc2dcd861ab31eb46bd839bfe8a465393ade11a2c8d9ad612b4cc1265fdb4cf2a0d373288d8cd20cc1cb7f3e8bf565e575e5204858390018dabaae28
TLSH
T16FD012A27A0DB840F6055331E25283012666256028539702B261D41CC6644DC13D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 02c9cb5e93eef395d5b545c5164331a6c69991c46db63a885bb32283633ec2c3
MD5 47785c51353955f17608dec84a50773d
SHA1 37e996ddc8fe049a96e563f704affecdb1d88d98
SHA512 b2e0de6652c6c6d81568f7aa95628989cd9f564422b74f29b6a350a922fc6950af8a7af26169503a7cc54363acd81e8fe5590c9b02868280799331662e85c524
TLSH
T122E026BA55CAC22E9748B54B6178470CC2D13A0FDEC8EACA1704848CB602244E7C6AA8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 06e99f07f1efbb22efd899b60e357e5f0bc2d40e67faced0732c475597ab7b3f
MD5 1c6431f35a0b01fe9b2da069e80b9a2f
SHA1 c358b8eb8b0c099343c66d56851b6fab5de6f6c0
SHA512 f84c23a1c182e2c0a26320ac90f24d03e3cdaef3c15679bf113d80da24e0700991ec4c0399913d7c17b8870cc6cc3a6256639d58c793ed1167b5ccf96c814bf2
TLSH
T113E0C8DB05D5C26DA514748B6174578CD5D13F0ED7C4FFC55704844C724564467D1D74
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e1c518a25bede8afd85d6169811294a782a52ee87203814b79aaadf3ffe93daf
MD5 29ea2953d3e9b29cf2058f53eff9d7c4
SHA1 c30e1c0db22e076cc89c1a5f76ebc0b4945e57e8
SHA512 ca9bcf387d9bfe41e3672977b2f4e9ccb6ea6318c48507bdc0e18b1ca2c5b8091e975bb30630bf5a63f7a4129d5c3a2e4f67731a59d6b78f76fcbe8d2175fa87
TLSH
T1BBE0269D48CEC22FA600B6C76174470CD2C03A0F9ACCEECE1F1899883202840A7C29F4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5dd2c9a7888da9173b0c6acefc691a43f5f68f074fdbb4ea7a34f21b9e4c29f4
MD5 e48c5512124dc687778d8a05bef95b87
SHA1 74988bf4d62eebd446f1eeb269a1fcfc4eec45bc
SHA512 3f22855ee87050f583bb13ed5cc62bd78e7bf064e723edeb806d1c1ebd3de3e6a0c93772b0b93243bc8b2f923378a5252582faa8ded197f2f06fbbeb13f105bf
TLSH
T11BE0268805C8C72EB600A887B1754B0CC2C03B8EDBC8FD8A170484DC324A440ABC2AE0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 89160156376483ccc25951cd94018792cdf2f377d8e35ce43bd7ed7544b27d1f
MD5 7bf71cc4a10f750fd54c60b622e7e830
SHA1 b1236f70e41632e464d87049df3304805e611657
SHA512 cd74e977c57a16668600b87e07ed1b6221302ac857e27852d47db35b387306dcd14299c5c9c2a306dc6d385450e466552b2725327d7b1931b9da7ae8078fdc6f
TLSH
T115618059CAD20882E7710532B5C112493EB18952BAE30EDF714DB87256DE72CCFEEE18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585724.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585724.TMP
Size 3KB
SHA256 16eb5361122528d6c228d678b5f5311261290f9996646a974c7caab0b865d42e
MD5 8ee1324b489f185c820072a086178548
SHA1 4633b4f3d3a01d9270480d19f2a7520f0fffe14a
SHA512 01fa516216c0e24d7e16183ace3b8f50c0f65214f5d53548ac0b4ff2cbbb528b2463ab918bcbbf2ec8a88a3db6b1efda6aaa87ecb8ff2b28dc153043adf01c12
TLSH
T10A618059CAD20882E7310532B5C112493EB18952BAE30EDF705DB87256DE72CCFEEE18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 91bf91cac10eb003fd1f12e7ff6c409a73d1886fce41657f777a519c677f2fdf
MD5 0857cea49b830ee138124c8781c7ace8
SHA1 3fff728110edfa1104f9616d0728eacc3c9b22a6
SHA512 6b30fa03c3bd44a6a293f46ba05cd8ba9d161d988778a566ac18703ca38799d35849bf106b054f35541982d111221666d4b5d561a77b9cd6b35885ab75220af1
SSDEEP 192:sxZrR8yM/jK1Ml8UQ4WT/fTszMdIdpGy4HW6+WNGhDT/Ycr0T9Ig5CJ:sxZrOqTT/fTs4eG3HbGd/os
TLSH
T14D52D716AA346E77CCDBD209B956BF53D6F5047292900E44A9FCDA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 28e8496aab444ad70e4c44717e566b559aae4d2303bab64d60d0cc079ce43cc5
MD5 deb6b67a5693090fdae34459e283b020
SHA1 286162b45f67c5b96908de54dd3c1e5dd7d5c056
SHA512 687d14444e9bd26bdd36ee8c19937c8f37e964bc4cbc67b3b4e3ba169d4fc9fbcccb0db75ae8c3d59fefd97afea334bce40a6af586c94207ef306460ff18b471
SSDEEP 192:sxZrR8yM/jK1Ml8MWT/fTsLMdIdp4y4HW6+WNGhDT/YcP/F9IgrJ:sxZrOuT/fTsQe43HbGd/t9
TLSH
T13542E7126A346E77CCDBD209BA55BF53D6F90472D2900E44A9FCDA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4680ba14cc67a015e2e3accb2495434afb51b8655a1b6117ddaa813a1fc2a706
MD5 03db4f47666ec1e1d4e74ff2e859f341
SHA1 cde35dced3580769e6b65d359424c78f3ab2f14f
SHA512 420428f2fa481b09a92310470fc0d646a64f4ddab94250a44d587148d0c20364db847e296a06eda5cccb6d55fa5e590af098d9c11369de8b3c8d72039627efc6
SSDEEP 768:OX03ifCWvqG1m8F1+UoAYDCx9Tuqh0VfUC9xbog/OVb9Ll1/CBTroFJEb:OX03ifCWvqG1mu1jaa9LfKBgn2
TLSH
T102D20B2B280CCB7E4F844E9CEC66AF966DD801CB56988D5447FA884C02C77EF512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6ba92c8-53f0-4431-b23c-88f47e76f432\index-dir\temp-index
Size 2KB
SHA256 99a94d584eface8011b8b356872b655869109d74967d74f5969e410ada841af2
MD5 d9c44b7b5d2ac5ed942fbd04b5496eea
SHA1 c1a079691d07b7505865fbdc17da177e619a3bfe
SHA512 525202d126f1662f2eb9ab8fb239b2cfe42c5bc489abd749a0f36ef4cfe5b64f910bae4ea9a4e2170a065bed3028cf97701a45b17423fabe9b76df45c8a97cf7
TLSH
T19A41A64D0D658A2BF86800B215B254D877B0D8DD5A649623DCBC23387D1736E195B7AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9e1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6ba92c8-53f0-4431-b23c-88f47e76f432\index-dir\the-real-index~RFe5c9e1c.TMP
Size 2KB
SHA256 86b88b30ad14c5d545650f729c72c7dc5ef091ba0def8217f2fc4a822a874753
MD5 1d3903d5aeeb9381c46b3356a857d474
SHA1 7bc7470f7531ed3f559b55dd01d1787d44e7fea8
SHA512 fb94c5b7f7ed54ff57eba25c704ce3fcd757e618d4b0c5d317ad95ed1f8e423c446f539fb08c03403f8d04fbd688b19f20563fc5ab59f1aa6763a81c87eb2383
TLSH
T1D941C94A4E818A2EE89440770DE2A4B87339580087157B4778FC5235ADA27ED2E5E0E9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2c900919f152a9a760569604b042192e96e231b960e774da05c6b1158343b923
MD5 86f02d80a9e21a2815268dd111325585
SHA1 e27478a2163a30e84c2c54fc87c242acdae79b66
SHA512 c35eb9423d5737d25285a86235c6672d77382efce5df0e5e11e8d83a4abd32df9c7d4786125ce22015c66fab01c1d6b0377ec7bae608975bcc47f2eb5bbbf60f
TLSH
T195E020B63CE73C50FD6FA7D7383148A54559B8D4D64DBC4F513951C310E13122452CA2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 3ddd4f9874a6399c17f89691c2c22d9158b93ccb41425874856035eb35db06b8
MD5 a16873f1d2958c8b6c59e963f8fe4e0b
SHA1 a15061d6ed41b0683f1bc1dd54b23a3274c51472
SHA512 923cd816553a24048a85c30900e7f0fb6b52d1939349da0efcdac39d774a6070a962a2042559f2d5572075aaa3f38f202a6ab8e580c2809d672c3ab626385dc3
SSDEEP 48:K3ob04KOCUiuNfIdwUKMRECUQ4EbNqYJySqBuKc0E2i0r9IdK2KMTEg2QSmbzwJM:KwFiKesam/uK4I/WgKvqiOhiKCgA
TLSH
T16BC1D71A707A0267387F6508AA968A365E4232773524E46FFB7804660F6BE124DFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b2ec9c2a279904d443253e7c2fb50ff11a6bf2162af51167f9c0b1fdbc53e66d
MD5 1d88fba13feb2ec01dbda05ca8f5da68
SHA1 ca506214de8701cd71f0a895078d106a8c3ad8ee
SHA512 8937d6ebb7350bd77c77b0154313d8b0bf1aa2c388652cf2e2023902eb04702b84cca83deabf53f52612939ba4f757274e68208d40893d49591c383d4d8ca0e6
SSDEEP 192:B3sUzsNtkEQibK/+r3QQmiU1NHHB4p5OBqf5YIjEE4h7upqh/U8:BbzsNtkEhG/qAPHuzOBm5/gNu8U8
TLSH
T1AB4209367C68AC775DA6A644F08737139EB84027DA893F94D2ED6E1C01DB79C234B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5ea481a52dd54431cafbb99b0da5fc77f58726eb0aa243258e5bcb476d61ed03
MD5 bb03da086c48dbb68eb778acaa7be84b
SHA1 72753838488998a58fd59d31519d7fa8b1c28405
SHA512 5ecb53fe50647bc9e4f125c6e41af7e80cd1d6e142bc7fac1abfe841b4ae64580037dead5246ce5a9b3ee8510615acefae0468f1edc5e9cdb3edba27f09c6013
SSDEEP 192:4eLsNIkLQibK/+r3QQmiU1NHHB4p5OBqf5YIjE6O7upqh/U8:4UsNIkLhG/qAPHuzOBm5/g/u8U8
TLSH
T1C73208327C68AC775DA6A254F04737139EB84027DA893F94D2ED6E1C01EB79C234B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9163034a5a58b23f6a949827353766b23888f73dbb36a93e7498fbf08b9bb542
MD5 202c4f8b1df24fbbf1a5fc0691cc0706
SHA1 f597c1d21b45a3a1ee55e82b5ba4803b39ae68ed
SHA512 953244079fba871d2d0355cde7567a5d8bbad3ab240b966a3eda2c156c434be077dfc39234df44ae5711387474ef9c3d692ec5afbc76c83a8969a5e5961e40f0
SSDEEP 192:B3sUzsN8kE/ibK/+r3QQmiU1NHHB4p5OBqf5YIjEE4h7upqh/U8:BbzsN8kEaG/qAPHuzOBm5/gNu8U8
TLSH
T1934208367C68AC775DA6A244F08736139FB84027DA893F94D2ED6E1C01DB79C234B51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c0bd604b1f2686d3a27a0d97aba1b74fafaff9c177bf4567ea072e7eaa1c2f25
MD5 8bff50ae29f2a250920d54a6aa1956be
SHA1 600ce798d685bc9c52d3015b7a90fa256350f6ee
SHA512 56cdeb3b3239efb85b790382057101b6a5016e301898a0d3b1ae8acb1e944db4fdaa83399a4813d033ae2867b639f92cca90db7957a10a97e5ca8fdb52652fea
SSDEEP 192:B3sUzsNIkEQibK/+r3QQmiU1NHHB4p5OBqf5YIjEHq7upqh/U8:BbzsNIkEhG/qAPHuzOBm5/ggu8U8
TLSH
T1A34208367C68AC775DA6A254F04737139EB8402BDA893F94D2ED6E1C01DB79C234B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b7cf4e1d90d554498855f51adc66de5fcd9960d2de83f251de9c43ff74fb281
MD5 dbd160825732ef6391335ef8438a915c
SHA1 83c31030a7c50e7900c937eb1e410bb9abab33eb
SHA512 6daf60d812746c05ac7633a22831fdd536bf801a85ccba26f3166a6593f975206cd47f868baf1ed46d773b3e4b706b958f8f6de810ac8d9f72d7f44d61222161
SSDEEP 192:mONB6v+uQmiUyOLqm5OBqf5YIjEWRiupqh/U6:mONB6vBrqUOBm5/g3u8U6
TLSH
T16012F9367C6CBC775D92A544F08736175EB94127EE8A3B94D1EC2E1C01EF6AC234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75ba6cc69a88ea7a13aab7358cdff4abee486c4cae950f166060ceafe8e74263
MD5 74bee9e021529652016a21050fe5a1b6
SHA1 e89cae67d1b7dde1f2e52bde148ff963767784b8
SHA512 daa1144160e5e17d2306bca90d7ae2dd7114b09890f015effcc992a48081949979be1ce729920cb8d1a3dee19c91081b49c9d628e9ff7100c48a04aabbf4076c
SSDEEP 192:eONpi6v+XaQmiUyuLCm5OBqf5YAlRutzU6:eONo6vt7CUOBm5PuhU6
TLSH
T12802E934BC6C7CB79EA26E05F08737175FE8103BEA962B84D5E85E1C00DB69C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b9a0d6611b5b8b17c2d933ad53c45c857899d96527b930343ad800decf7f6ee9
MD5 b7c32f2b0f7bb68667e7aa7c9f114628
SHA1 1b476227533e1048ba27603c0a982a1a5aa59f75
SHA512 b340d551ba73ad67061ab9001a84eb69bffcad18071a434a7945970e03384069ef6f4d45601562497e0a8cfc8c09067afbf97acf7c51d722c4006388c353bf41
SSDEEP 192:peLsNIkEQibK/+r3QQmiU1NHHB4p5OBqf5YIjE6O7upqh/U8:pUsNIkEhG/qAPHuzOBm5/g/u8U8
TLSH
T1293208327C68AC775DA6A654F04737139EB84027DA893F94D2ED6E1C01DB79C234B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33012ebe-f773-445a-ba6f-95f8e2498510.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\33012ebe-f773-445a-ba6f-95f8e2498510.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0fcc3d50a86cf7049d351224356642e540d5ac262999a73583e5de5a620fe5d5
MD5 e68fff8aae879058ae4e4e753ca5d14e
SHA1 7e8a5e29ec114b7d3c1a05337fda22ae1e87ca57
SHA512 69b2021ff3c697b72eb19cbd31182249c5bae5e28f0dab29031bdad9629469d90a70b82d28a86ecd7ecbd09df7fb6c3fab198dab2cc2ef988277ade24da778fa
TLSH
T11241EB9CA6F91158B3B76F1AAFF7696D887B78372E06D09D00110E4F0A62B40DC61B37
MD5 SHA1 SHA512 TLSH

Submit Download